The dashboard — useful, and an exposed web service

Intermediate⏱ ~15 minceph

What you'll learn

Enable and configure the dashboard correctly
Identify tasks the dashboard suits and those it does not
Apply appropriate authentication and network restrictions
Manage dashboard users and roles

Prerequisites

None — start here.

Verified against Ceph Tentacle 20.2.x · Ceph Squid 19.2.x (supported previous) · cephadm matches the verified Ceph release · podman 4.x · csi-rbd and csi-cephfs current · RBD / CephFS / RGW current (matches Ceph release) · Linux kernel 5.15+ (5.10 minimum) · Ubuntu 24.04 LTS (Ceph host baseline) · Debian 12 (Bookworm) (Ceph host baseline) · Rocky Linux / RHEL / AlmaLinux 9.x (Ceph host baseline) · Proxmox VE 9.x (cross-course integration) · Kubernetes 1.31+ (cross-course integration) · 2026-08-18

Why this matters in production

The dashboard is a full administrative interface to a storage cluster, reachable over HTTP. It is genuinely useful and it is also the most exposed component most Ceph clusters have.

Enabling it

ceph mgr module enable dashboard
ceph dashboard create-self-signed-cert          # or install a real cert
ceph config set mgr mgr/dashboard/server_addr 10.0.2.10
ceph config set mgr mgr/dashboard/server_port 8443
echo -n 'a-strong-password' > /tmp/pw
ceph dashboard ac-user-create alice -i /tmp/pw administrator
shred -u /tmp/pw
ceph mgr services

Binding to a specific address matters. The default binds broadly, and a storage cluster’s management interface should not be reachable from tenant networks.

Installing a real certificate:

ceph dashboard set-ssl-certificate -i /path/cert.pem
ceph dashboard set-ssl-certificate-key -i /path/key.pem
ceph orch daemon restart mgr

Treat the dashboard as an administrative interface, because it is one

Through the dashboard a user can create and delete pools, change size and min_size, mark OSDs out, and manage RGW users and their credentials. Deleting a pool through a web form destroys data just as completely as the CLI does.

The minimum posture:

A real TLS certificate, not the self-signed default, so certificate warnings remain meaningful.
Bound to a management network and firewalled from tenant networks.
Per-person accounts with roles, never a shared admin login.
read-only role for anyone who only needs to look.
Access reviewed when people change roles or leave.

ceph dashboard ac-role-show read-only
ceph dashboard ac-user-create bob -i /tmp/pw read-only
ceph dashboard ac-user-set-roles alice administrator

What it is good at

Browsing cluster state. OSD tree, pool list, PG summaries, host inventory — faster to scan visually than to assemble from commands.
Capacity views. Per-pool usage and projections.
RBD image management. Listing, snapshots, and basic operations.
RGW user and bucket management. Genuinely more pleasant than radosgw-admin.
Onboarding. People new to Ceph orient faster with a visual map of the cluster.

What the CLI remains better at

Anything scripted or repeatable. The dashboard has no history and produces no artefact.
Incident work. ceph pg query, ceph osd perf, and log reading have no dashboard equivalent with the same depth.
Precise operations. CRUSH edits, capability management, and anything needing exact arguments.
Change tracking. A command in a runbook is reviewable; a click is not.

Why the dashboard depends on the active manager and what that implies

The dashboard runs inside the active manager process. When the manager fails over, the dashboard restarts on the new active manager and open sessions are dropped.

Two implications follow. First, the dashboard URL should point at something that follows the active manager — either a load balancer, a DNS name updated by automation, or the mgr services output consulted each time. Pointing at a specific host means the dashboard appears broken after every failover.

Second, dashboard responsiveness is manager responsiveness. On a large cluster where the manager is already busy collecting statistics, the dashboard feels slow for the same reason ceph status does — and the remedy is the same: manager resources, fewer modules, and not colocating the manager with busy OSDs.

A reasonable configuration

# Substitute your own value before running:
DASH_USER=jrivera

ceph config set mgr mgr/dashboard/server_addr 10.0.2.10
ceph dashboard set-ssl-certificate -i /etc/ssl/ceph-dash.pem
ceph dashboard set-ssl-certificate-key -i /etc/ssl/ceph-dash.key
ceph dashboard set-login-banner -i /etc/ceph/banner.txt
ceph dashboard ac-user-create "$DASH_USER" -i /tmp/pw read-only

Then verify from a tenant network that it is not reachable.

Quiz

Knowledge check · 4 questions

Q1. The dashboard URL stops working after every manager failover. What is the correct fix?

Disable and re-enable the dashboard module so it rebinds after each manager failover Run the dashboard module on every manager at once so the standbys also serve the URL Point the URL at something that follows the active manager rather than at a fixed host Increase the dashboard session timeout so open sessions survive a manager failover
Q2. The dashboard is a read-oriented status view, so its security posture matters less than that of the CLI.

True False
Q3. A security review finds the Ceph dashboard reachable from the tenant VM network with a self-signed certificate and a shared admin account. Plan the remediation.

Production cluster serving RBD to 300 tenant VMs and RGW to external clients. The dashboard binds to 0.0.0.0 on the default port. Certificate is the self-signed one created at enable time. One shared admin account is used by six operators, with the password in a team wiki. No access log review has ever been done.
Q4. Contrast what the dashboard suits with what the CLI remains better for.

Passing score: 75%. Answers are checked in this browser.

Production discipline

Bind the dashboard to a management address, firewall it from tenant networks, and verify the exposure is closed by testing from a tenant host rather than reading the configuration. Install a real certificate so warnings retain meaning, and use per-person accounts with roles so administrative actions are attributable. Point the URL at something that follows the active manager. And keep incident work and anything repeatable in the CLI, where it leaves a reviewable artefact.

Cross-course references

Ceph: Part CII (Management Security) for the wider posture.
Ceph: Part XLVI (RGW Users and Credentials) for what the dashboard can manage.
Ceph: Part X lesson on failover for why the URL moves.